diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2dcc141..55c2bc2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,10 @@ permissions:
 
 jobs:
   rust:
+    # Dependabot PRs update dependency metadata only; avoid consuming a
+    # self-hosted runner for every automated update. Skipped jobs report a
+    # successful check, so required checks do not remain pending.
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: [self-hosted, node-b, linux, x64, rust]
     env:
       FORGEJO_CARGO_TOKEN: ${{ secrets.FORGEJO_CARGO_TOKEN }}
@@ -37,6 +41,7 @@ jobs:
       - run: cargo test --workspace
 
   frontend:
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: [self-hosted, node-b, linux, x64, rust]
     steps:
       - uses: actions/checkout@v7
diff --git a/.github/workflows/policy.yml b/.github/workflows/policy.yml
index 5c2a1de..0764c92 100644
--- a/.github/workflows/policy.yml
+++ b/.github/workflows/policy.yml
@@ -11,6 +11,9 @@ permissions:
 
 jobs:
   policy:
+    # Dependabot PRs do not need another policy scan on the self-hosted
+    # runner; the workflow check is recorded as successful when skipped.
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: [self-hosted, node-b, linux, x64, rust]
     steps:
       - uses: actions/checkout@v7